Privacy Policy
Effective: September 11, 2026
Three Gates is built by Hearth and Alloy, Inc., a small company in Tennessee. This page explains what information we collect when you use our website, take the PHI readiness assessment, or have an account on the platform, and what we do with it. We have kept it short on purpose. If it does not answer your question, email privacy@threegates.ai.
What we collect
If you visit the site, Google Analytics records usage data when you accept analytics cookies; you can decline them in the cookie banner, and the Cookie Policy has the details. If you take the assessment, we keep your organization, role, work email, and answers so we can send you your results and follow up if you asked us to. If you have a platform account, we keep your name, work email, organization, role, and the logs the platform produces when you use it. If you email us, we keep the email.
What we do with it
We use it to run the site and the platform, send you what you asked for, answer you, keep things secure, and meet legal obligations. We do not sell it and we do not use it for advertising.
Health information
Three Gates is a business associate to healthcare organizations. Any protected health information a customer runs through the platform is governed by the Business Associate Agreement with that customer, not by this page. We never use PHI for marketing, and we do not train models on customer data. We do not keep patient records. If you are a patient with a question about your health information, your healthcare provider is the right place to ask, and we will help them as our agreement requires.
Who else sees it
We use Microsoft for Azure hosting and for the Azure AI Foundry and Azure OpenAI model destinations currently supported for workflows involving sensitive data. Those services run in our infrastructure or under our agreements, and detected sensitive values are tokenized before any model invocation. We use Stripe for billing and Google Analytics for website analytics; neither receives PHI. Authorities may receive information if the law requires it. If this list changes in a way that matters, we will say so here.
Security
Our Security page describes what we do. No system is perfect; if you think your information has been exposed, email security@threegates.ai.
How long we keep it
We keep account information while your account is active and for a while afterward for security and legal reasons. We keep assessment data until you ask us to delete it. Platform records are kept for as long as the customer agreement says. Ask us to delete what we hold about you and we will, unless the law or a contract requires otherwise.
Your choices
Email us to see, correct, or delete your information, or to stop hearing from us. We are a US company operating in the US. We are below the size at which state privacy laws impose formal request processes on a business; we honor reasonable requests regardless.
Children
Our services are for organizations and their staff, not for anyone under 18.
Changes
We will post changes here with a new date and email account holders about anything significant.
Contact
Hearth and Alloy, Inc. c/o Northwest Registered Agent Inc. 116 Agnes Rd Ste 200 Knoxville, TN 37919, USA privacy@threegates.ai